Source kernel · Security

SQL text assembled from runtime values

rust_doctor::source::sql_built_from_format

Keep the SQL text constant and bind the value as a parameter: .bind() or query! with sqlx, push_bind() on a sqlx QueryBuilder, .bind::<T, _>() with diesel, the params argument with rusqlite and postgres.

Category: Security
Default level: warn
Tier: P1
Producer: Source kernel
Diff scope: item

Not a defect when

The interpolated value is an identifier chosen from a fixed allowlist in code, such as a column name mapped from an enum for ORDER BY, which placeholders cannot bind anyway.

Crates it waits for

It runs only where at least one of these crates is resolved, and every one resolved sits in the range it was validated on:

diesel *
postgres *
rusqlite *
sea-orm *
sqlx *
tokio-postgres *

What it reads

Source text, without resolving types or expanding macros.

Tier

Serious: worth interrupting other work for.

The tier bounds how severe a rule may be; its category bounds the tier.

Diff scope

The function or item around the changed line.

What --scope contextual looks at to decide whether a change caused the finding.

Change it

Turn it off, or make it blocking, without touching the code it flags:

rust-doctor --rule rust_doctor::source::sql_built_from_format=off .
rust-doctor --rule rust_doctor::source::sql_built_from_format=error .